From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from gate001.proxmox.com (gate001.proxmox.com [IPv6:2a0f:8001:1:32::40]) by lore.proxmox.com (Postfix) with ESMTPS id D94E61FF0B3 for ; Wed, 28 Oct 2026 16:10:17 +0100 (CET) Received: from gate001.proxmox.com (localhost.localdomain [127.0.0.1]) by gate001.proxmox.com (Proxmox) with ESMTP id 931EF215F5; Wed, 28 Oct 2026 16:10:10 +0100 (CET) From: Fiona Ebner To: pve-devel@lists.proxmox.com Subject: [PATCH qemu v3 2/2] fix crash when querying VirtIO information via QMP/HMP Date: Wed, 28 Oct 2026 16:08:19 +0100 Message-ID: <20261028151001.224063-3-f.ebner@proxmox.com> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20261028151001.224063-1-f.ebner@proxmox.com> References: <20261028151001.224063-1-f.ebner@proxmox.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Bm-Milter-Handled: 55990f41-d878-4baa-be0a-ee34c49e34d2 X-Bm-Transport-Timestamp: 1793200205093 X-SPAM-LEVEL: Spam detection results: 0 AWL 0.334 Adjusted score from AWL reputation of From: address DMARC_MISSING 0.1 Missing DMARC policy KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment (newer systems) RCVD_IN_DNSWL_MED -2.3 Sender listed at https://www.dnswl.org/, medium trust SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record Message-ID-Hash: 3QLQYEXHFDZBA3DBMES5XZQG5IGHKFTR X-Message-ID-Hash: 3QLQYEXHFDZBA3DBMES5XZQG5IGHKFTR X-MailFrom: f.ebner@proxmox.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header X-Mailman-Version: 3.3.10 Precedence: list List-Id: Proxmox VE development discussion List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: Signed-off-by: Fiona Ebner --- Changes in v3: * Use 11.1.3 as a base. Almost all changes from this patch in its v2 version are now already included there. ...ore-backend-features-in-x-query-virt.patch | 41 ++++++++++ ...dle-missing-vhost-user-protocol-feat.patch | 74 +++++++++++++++++++ debian/patches/series | 2 + 3 files changed, 117 insertions(+) create mode 100644 debian/patches/extra/0005-qapi-virtio-Restore-backend-features-in-x-query-virt.patch create mode 100644 debian/patches/extra/0006-qapi-monitor-Handle-missing-vhost-user-protocol-feat.patch diff --git a/debian/patches/extra/0005-qapi-virtio-Restore-backend-features-in-x-query-virt.patch b/debian/patches/extra/0005-qapi-virtio-Restore-backend-features-in-x-query-virt.patch new file mode 100644 index 0000000000..cbee94c9fc --- /dev/null +++ b/debian/patches/extra/0005-qapi-virtio-Restore-backend-features-in-x-query-virt.patch @@ -0,0 +1,41 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Vladimir Sementsov-Ogievskiy +Date: Wed, 23 Sep 2026 00:32:09 +0300 +Subject: [PATCH] qapi/virtio: Restore backend features in + x-query-virtio-status + +Commit 1ee0bc0c9bf0 removed vhost_dev.backend_features and its +representation in VhostStatus. It also removed the assignment to +VirtioStatus.backend_features, although both that field and its source, +VirtIODevice.backend_features_ex, still exist. + +The resulting NULL pointer causes HMP info virtio-status and QMP +x-query-virtio-status to crash. This affects virtio devices even without +an active vhost backend. + +Restore the assignment from VirtIODevice.backend_features_ex and +enable corresponding test, which becomes fixed. + +Fixes: 1ee0bc0c9bf0 ("vhost: drop backend_features field") +Signed-off-by: Vladimir Sementsov-Ogievskiy +Link: https://lore.kernel.org/qemu-devel/20260922213210.1429435-3-vsementsov@yandex-team.ru +(pick from qemu-devel) +[FE: drop test that would require multiple prerequisite cherry-picks] +Signed-off-by: Fiona Ebner +--- + hw/virtio/virtio-qmp.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/hw/virtio/virtio-qmp.c b/hw/virtio/virtio-qmp.c +index 57cc03828c..36907180f7 100644 +--- a/hw/virtio/virtio-qmp.c ++++ b/hw/virtio/virtio-qmp.c +@@ -713,6 +713,8 @@ VirtioStatus *qmp_x_query_virtio_status(const char *path, Error **errp) + vdev->guest_features_ex); + status->host_features = qmp_decode_features(vdev->device_id, + vdev->host_features_ex); ++ status->backend_features = qmp_decode_features(vdev->device_id, ++ vdev->backend_features_ex); + + switch (vdev->device_endian) { + case VIRTIO_DEVICE_ENDIAN_LITTLE: diff --git a/debian/patches/extra/0006-qapi-monitor-Handle-missing-vhost-user-protocol-feat.patch b/debian/patches/extra/0006-qapi-monitor-Handle-missing-vhost-user-protocol-feat.patch new file mode 100644 index 0000000000..ce3c49cce0 --- /dev/null +++ b/debian/patches/extra/0006-qapi-monitor-Handle-missing-vhost-user-protocol-feat.patch @@ -0,0 +1,74 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Vladimir Sementsov-Ogievskiy +Date: Wed, 23 Sep 2026 00:32:10 +0300 +Subject: [PATCH] qapi/monitor: Handle missing vhost-user protocol features + +Commit f9a8f5812607 moved protocol_features to the vhost-user backend. +As a result, VhostStatus.protocol_features is only populated for +vhost-user devices. + +For an active kernel vhost device, HMP info virtio-status and QMP +x-query-virtio-status crashes now because of unset protocol-features. + +Make protocol-features optional in VhostStatus and skip dumping a +missing object in HMP. + +For QMP we can change the x-query-virtio-status command semantics +because it is unstable. + +Enable corresponding test, it works now. + +Fixes: f9a8f5812607 ("vhost: move protocol_features to vhost_user") +Co-authored-by: Nikolay Kuratov +Signed-off-by: Vladimir Sementsov-Ogievskiy +Reviewed-by: Markus Armbruster +Link: https://lore.kernel.org/qemu-devel/20260922213210.1429435-4-vsementsov@yandex-team.ru +(pick from qemu-devel) +[FE: backport adapting to missing monitor_hmp_printf refactor + drop test would require multiple prerequisite cherry-picks] +Signed-off-by: Fiona Ebner +--- + hw/virtio/virtio-hmp-cmds.c | 6 ++++-- + qapi/virtio.json | 5 +++-- + 2 files changed, 7 insertions(+), 4 deletions(-) + +diff --git a/hw/virtio/virtio-hmp-cmds.c b/hw/virtio/virtio-hmp-cmds.c +index a91bb7dbed..c4adb6eb7b 100644 +--- a/hw/virtio/virtio-hmp-cmds.c ++++ b/hw/virtio/virtio-hmp-cmds.c +@@ -176,8 +176,10 @@ void hmp_virtio_status(Monitor *mon, const QDict *qdict) + hmp_virtio_dump_features(mon, s->vhost_dev->features); + monitor_printf(mon, " Acked features:\n"); + hmp_virtio_dump_features(mon, s->vhost_dev->acked_features); +- monitor_printf(mon, " Protocol features:\n"); +- hmp_virtio_dump_protocols(mon, s->vhost_dev->protocol_features); ++ if (s->vhost_dev->protocol_features) { ++ monitor_printf(mon, " Protocol features:\n"); ++ hmp_virtio_dump_protocols(mon, s->vhost_dev->protocol_features); ++ } + } + + qapi_free_VirtioStatus(s); +diff --git a/qapi/virtio.json b/qapi/virtio.json +index 1fc4e38a44..f8e699a0e4 100644 +--- a/qapi/virtio.json ++++ b/qapi/virtio.json +@@ -85,7 +85,8 @@ + # + # @acked-features: vhost_dev acked_features + # +-# @protocol-features: vhost_dev protocol_features ++# @protocol-features: vhost-user protocol features. Present only for ++# vhost-user devices. + # + # @max-queues: vhost_dev max_queues + # +@@ -104,7 +105,7 @@ + 'vq-index': 'int', + 'features': 'VirtioDeviceFeatures', + 'acked-features': 'VirtioDeviceFeatures', +- 'protocol-features': 'VhostDeviceProtocols', ++ '*protocol-features': 'VhostDeviceProtocols', + 'max-queues': 'uint64', + 'backend-cap': 'uint64', + 'log-enabled': 'bool', diff --git a/debian/patches/series b/debian/patches/series index 3140ed6230..1828cca017 100644 --- a/debian/patches/series +++ b/debian/patches/series @@ -2,6 +2,8 @@ extra/0001-monitor-qmp-fix-race-with-clients-disconnecting-earl.patch extra/0002-fdmon-io_uring-avoid-idle-event-loop-being-accounted.patch extra/0003-block-vmdk-tolerate-known-seSparse-reserved1-bit.patch extra/0004-hw-scsi-lsi53c895a-gracefully-handle-re-entrant-DMA.patch +extra/0005-qapi-virtio-Restore-backend-features-in-x-query-virt.patch +extra/0006-qapi-monitor-Handle-missing-vhost-user-protocol-feat.patch bitmap-mirror/0001-drive-mirror-add-support-for-sync-bitmap-mode-never.patch bitmap-mirror/0002-drive-mirror-add-support-for-conditional-and-always-.patch bitmap-mirror/0003-mirror-add-check-for-bitmap-mode-without-bitmap.patch -- 2.47.3